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In a recent paper [S. Bagherinezhad and V. Karimipour, Phys. Rev. A 67, 044302 (2003)], a 
quantum secret sharing protocol based on reusable GHZ states was proposed. However, in this 
Comment, it is shown that this protocol is insecure if Eve employs a special strategy to attack. 
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In a recent paper Q, Bagherinezhad and Karim- 
ipour proposed a quantum secret sharing protocol based 
on reusable GHZ states. The security against both 
intercept-resend strategy and entangle-ancilla strategy 
was proved. However, here we will show that with the 
help of her ancilla Eve can obtain half of the data bits 
without being detected by the communication parties. 

For convenience, we use the same notations as in Ref. 
0. We will begin with the property of states |0) 12 and 

1 1)12 under the Pauli operation a x = ( ^ q ~\ (i.e., flip- 
ping). That is, it has the same effect to perform a x on 
the qubit 1 or 2 in the Bell states |0) 12 and |1) 12 , i.e., 
the state |0)i 2 (| 1) 12) will be converted into |I) 12 ( 1 0) 12 ) 
when a a x operation is performed on either of the two 
qubits. This can be described by 

(Txl ® I 2 10) 12 = Ii <8> CT x2 |0)i2 = |T)i 2 
OkL<g>l2|I)l2=Il® |I) 12 = 1 0)l2 (1) 

where I denotes the identity operation. As a result, the 
states 1 0)12 and |l)i 2 will be changed into each other un- 
der odd times a x operation, and be left alone under even 
times a x operation (including the operations on either 
qubit). This property will be used later. 

Now let us give an explicit description of Eve's strategy. 
In the beginning, Alice, Bob and Charlie share a GHZ 
state \G) = (1/V2)(|000) + |111)) as carrier, and the data 
bits Alice wants to distributed to Bob and Charlie can 
be represented by <?i , 92 > <?3 , ■ ■ ■ , 9n ■ Eve prepares a qubit 
in state |0) as her ancilla. 

(i) In the first round, Eve intercepts the first sending 
qubit (the one denoted by subscript 1) and performs a 
CNOT operation C\ e on this qubit and her ancilla after 
Alice sent the particles, which produces the state 

K 6ce i2> = ^(loooooo) + 1111111)) (qi = 0) 

or \Kbeel2) = 7^(1000111) + 1111000)) ( qi = 1) (2) 

and then resends it to Bob. Here we use superscripts 
and 1 to denote the states corresponding to q\ = and 



qi = 1, respectively. This notation also applies to the 
following equations and we will, for simplicity, suppress 
the word "or" later. 

It is obvious that these eavesdropping actions intro- 
duce no error when Bob and Charlie disentangle the send- 
ing qubits from the carrier. After that, the state of Alice, 
Bob, Charlie and Eve can be specified by 

|9° 6ce ) odd = t^(Ioooo) + 11111)) 

\®abce)oM = 7^(10001} + 11110)) (3) 

(ii) Eve performs a Hadamard gate on her ancilla. Ac- 
cording to the protocol in Ref. y|, before entangle \q 2 ) 
to the carrier, Alice, Bob and Charlie will do the same 
actions on their respective qubits. As a result, the en- 
tangled state will be converted into 
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(|0000) + 10011) 



+ 10101) + |0110) + |1001) + |1010> + |1100) + |1111>) 

\®l b ce)even = H^\Q\ bce ) od4 = ^=(|0000> - |0011) 

-|0101) + |0110) - |1001) + |1010) + |1100) - |im))(4) 

(iii) In the second round, Eve intercepts the first send- 
ing qubit and performs a CNOT operation C e \ on this 
qubit and her ancilla after Alice sent the particles, and 
then resends it to Bob. By these actions, Eve's aim is to 
avoid being detected by the communication parties. 

After Bob and Charlie disentangled the sending qubits 
from the carrier, according to the protocol in Ref. pj, 
each of the four parties has made a CNOT operation on 
their respective qubit (as the control qubit) and one of 
the sending qubits (as the target qubit). Furthermore, 
it can be seen from Eq. that all the items in both 
192 
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bee/even 



have even weights. Therefore, 
the effect of the above four CNOT operations is equiva- 
lent to flipping either qubit in the transmitted state \q) 
even times. With the help of the property of \q) intro- 
duced in above paragraphs, we can draw a conclusion 
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that Eve's actions introduce no error in this round and 
the state |6° bce ) el , e „ or |6^ fcce ) et , e „ is not changed. Hence 
Eve will avoid the detection of the communication par- 
ties, though she can not obtain any information about 
the data bit transmitted in this round. 

(iv) As Alice, Bob and Charlie will do, Eve also 
performs a Hadamard gate on her ancilla. These 
four Hadamard operations change the entangled state 

) into \®°abce)odd (\<3> abce )odd) as 
described in Eq. @, which will be used as a carrier in 
the next round. 

(v) In the third round, Eve can obtain partial infor- 
mation about the data bit without being detected by 
performing operation C e i, making a measurement on the 
first sending qubit and performing C e i again. 

The particular process is as follows. Suppose the clas- 
sical bit to be transmitted (that is, q^) is encoded as 
\Q> q) (q — or !)• When Alice has entangled the sending 
qubits to the carrier, the state of whole system can be 
described by 

I$° 6ce i2> = ^jd 0000 ' ?> + I 1111 . 9 + !> 1 + !)) 
\Kbcei2) = ^(10001, q) + 11110, q + l,q + l)) (5) 

where the addition is performed modulo 2. 

After the two particles were sent out by Alice, Eve 
intercepts the first qubit and performs a CNOT operation 
C e i, producing the state 

I"a & ce21> = ^=(|0000, q) + 11111, 9+ l».6ce2|ff)l 
l^a fc c e 2l) = ^(|0001,«) + |1110,« + l))„6ca2|«+l)l(6) 

where we have suppressed the ® symbol. It can be seen 
from Eq. |JBJ that the qubit 1 has been disentangled from 
the entangled state. Eve then makes a measurement on 
this qubit in B z = {|0), |1)} basis and gets the result 
q (when q\ = 0) or q + 1 (when q\ = 1). Let r< (i = 
1,2, ...,n) denote the eavesdropping results on data bits 
qi. Eve knows that r% — q% (when q\ = 0) or r 3 = q% + 1 
(when qi = 1). Afterwards, Eve performs C e i again to 
recover the state as in Eq. (JSJ, and then resends this 
particle to Bob. 

It can be easily verified that Eve's actions introduce 
no error when Bob and Charlie disentangle the sending 
particles from the carrier. Besides, the carrier and Eve's 
ancilla is still in the state \<d abce ) o dd or \& l abc ^odd as in 
Eq. ®. 

(vi) Eve uses similar operations to eavesdrop in the 
following rounds. That is, she takes the same actions as 



in step.(v) in odd rounds and the actions as in step.(iii) in 
even rounds. Furthermore, when Alice, Bob and Charlie 
perform Hadamard gates on their respective qubits at 
the end of every round, Eve does the same thing (as in 
step.(ii) and step.(iv)). 

Through above strategy, Eve can avoid the detection 
of the three legal parties and even extract information 
about the odd numbered data bits at the end of commu- 
nication. We mean the measurement results r^, r-j, 
T2m+i (where m = 1, 2... and 2m + 1 < n). Thus Eve 
can draw a conclusion that Alice's odd numbered data 
bits qi, q 3 , q 5 , q 2m +i must be equal to 0, r 3 , r 5 , 
r 2m+ i or 1, r 3 + 1, r 5 + 1, r 2m +i + !• 

The above eavesdropping result seems not so beautiful 
because there are still two possibilities. However, accord- 
ing to the protocol in Ref. |l( , the three legal parties have 
to compare a subsequence of the data bits publicly to de- 
tect eavesdropping, which will leak useful information to 
Eve. More specifically, as long as any odd numbered 
data bit is announced, Eve can determine which of the 
two possible results is true. By this means Eve can ob- 
tain the odd numbered data bits completely except for 
the little-probability event that all the compared bits are 
even numbered. 

It should be pointed out that the QKD protocol in 
Ref. Q, which inspires the work of Bagherinezhad and 
Karimipour Q], has the same hidden troubles, where Eve 
can use similar strategy to extract partial information 
about the distributed key. From this kind of attack we 
can draw two instructive conclusions. Firstly, when we 
employ the maximally entangled states as carriers like 
the protocols in Q, , it can not effectively prevent a po- 
tential eavesdropping to perform a Hadamard gate 0] or 
a 7r/4 rotation |2| on each qubit in the carriers. Secondly, 
scheme designers should ensure that the announcement 
of subsequence, i.e., the means by which the users detect 
eavesdropping, would leak no useful information to the 
eavesdropper. 

In conclusion, we have presented a eavesdropping strat- 
egy which allows Eve to obtain half of the data bits 
without being detected by the communication parties in 
Bagherinezhad-Karimipour protocol. Consequently this 
protocol is insecure against this type of attack. 
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